{
  "@id": "urn:uuid:3ca0afdd-0716-4e92-b62d-16969ebca746",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T20:24:59.518987+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.15.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "action_statement": "Vulnerability CVE-2014-7191 affects version 6.15.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.15.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.15.4 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-11-06T20:24:00.028165+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 does not affect version 6.15.4 of qs. not_affected \u2014 qs 6.15.4 already enforces arrayLimit on empty-bracket notation. The upstream fix (ljharb 3086902, shipped in v6.14.1) is in the upstream release that was onboarded, so the vulnerable pattern is not present in HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "impact_statement": "not_affected \u2014 qs 6.15.4 already enforces arrayLimit on empty-bracket notation. The upstream fix (ljharb 3086902, shipped in v6.14.1) is in the upstream release that was onboarded, so the vulnerable pattern is not present in HEAD."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.15.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-11-04T15:17:41.975123+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "action_statement": "Vulnerability CVE-2026-110910 affects version 6.15.4 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-11-06T20:24:59.518987+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.15.4 of qs. not_affected \u2014 qs 6.15.4 already contains the upstream fix for CVE-2026-2391. The fix is upstream commit 52afe00 by Jordan Harband, which is in the v6.15.4 release. With comma:true and throwOnLimitExceeded, oversized comma values now throw before the split. Without the throw option, the split result is converted to an overflow object under arrayLimit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 qs 6.15.4 already contains the upstream fix for CVE-2026-2391. The fix is upstream commit 52afe00 by Jordan Harband, which is in the v6.15.4 release. With comma:true and throwOnLimitExceeded, oversized comma values now throw before the split. Without the throw option, the split result is converted to an overflow object under arrayLimit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.15.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.15.4 of qs.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.15.4 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-11-06T20:24:59.518987+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.15.4 of qs. not_affected \u2014 qs 6.15.4 already contains the upstream fix (ljharb/qs 21f80b3). In lib/stringify.js the comma + encodeValuesOnly branch wraps the encoder with a null guard, so null/undefined array elements no longer reach utils.encode. The fix commit is authored by the upstream maintainer, is an ancestor of HEAD, and shipped in the upstream v6.15.4 release. HEAD has no TuxCare-domain commits, so the verdict i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 qs 6.15.4 already contains the upstream fix (ljharb/qs 21f80b3). In lib/stringify.js the comma + encodeValuesOnly branch wraps the encoder with a null guard, so null/undefined array elements no longer reach utils.encode. The fix commit is authored by the upstream maintainer, is an ancestor of HEAD, and shipped in the upstream v6.15.4 release. HEAD has no TuxCare-domain commits, so the verdict i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.15.4.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}